fix(sanitizer): extend UNICODE_BYPASS_RE to cover BIDI, soft hyphen, TAGS block (#4760)

[bug-ops]

Summary

• Replaces the 5-codepoint explicit class in UNICODE_BYPASS_RE with \p{Cf} (Unicode Format category) plus explicit U+034F (CGJ, category Mn)
• Covers BIDI overrides/isolates (U+202A–202E, U+2066–2069), soft hyphen (U+00AD), Mongolian vowel separator (U+180E), invisible math operators, deprecated format chars (U+206A–206F), and the TAGS block (U+E0000–E007F)
• Adds 9 regression tests for each bypass vector, heterogeneous runs, and false-positive negative
• No Cargo.toml changes needed — regex crate already enables unicode-perl by default

Security impact

BIDI override characters and the TAGS block are documented in adversarial LLM prompt injection payloads. The old 5-codepoint class left these unblocked; this fix closes the gap for all Unicode Format (Cf) category characters automatically, making the pattern future-proof against new Cf additions.

Residual gap (follow-up)

Variation selectors (U+FE00–FE0F, category Mn) and Hangul fillers (category Lo) are not covered by \p{Cf} and have low practical exploitability in the !…[ context. A separate P3 follow-up issue will track these.

Test plan

• 328/328 zeph-sanitizer tests pass (cargo nextest run --workspace --features sqlite -E 'package(=zeph-sanitizer)')
• cargo +nightly fmt --check clean
• cargo clippy -p zeph-sanitizer -p zeph-memory -p zeph-db -- -D warnings clean
• Security audit by rust-security-maintenance agent
• Adversarial critique by rust-critic (verdict: minor, non-blocking)
• Code review approved

Closes #4760.